Summary
[3.0.13-15]
- Fixes EAP-PWD: DoS issues due to multithreaded BN_CTX access
Resolves: bz#1818808
[3.0.13-14
- Fixes receiving of multiple RADIUS packets under load
Resolves: bz#1630684
[3.0.13-13]
- Fixes logging of cleartext pap password
Resolves: bz#1677435
[3.0.13-12]
- Fixes paircompare with attribute references and expansions
Resolves: bz#1592741
[3.0.13-11]
- Fixes logrotate, EAP-PWD vulnerability
Resolves: bz#1719368 privilege escalation due to insecure logrotate configuration
Resolves: bz#1751796 eap-pwd: Information leak due to aborting when needing more than 10 iterations
Fixed packages 12
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 7 | freeradius | 0:3.0.13-15.el7 |
| Oracle Linux · 7 | freeradius-devel | 0:3.0.13-15.el7 |
| Oracle Linux · 7 | freeradius-doc | 0:3.0.13-15.el7 |
| Oracle Linux · 7 | freeradius-krb5 | 0:3.0.13-15.el7 |
| Oracle Linux · 7 | freeradius-ldap | 0:3.0.13-15.el7 |
| Oracle Linux · 7 | freeradius-mysql | 0:3.0.13-15.el7 |
| Oracle Linux · 7 | freeradius-perl | 0:3.0.13-15.el7 |
| Oracle Linux · 7 | freeradius-postgresql | 0:3.0.13-15.el7 |
| Oracle Linux · 7 | freeradius-python | 0:3.0.13-15.el7 |
| Oracle Linux · 7 | freeradius-sqlite | 0:3.0.13-15.el7 |
| Oracle Linux · 7 | freeradius-unixODBC | 0:3.0.13-15.el7 |
| Oracle Linux · 7 | freeradius-utils | 0:3.0.13-15.el7 |
Vulnerabilities 3
-
Medium 6.4
It was discovered freeradius up to and including version 3.0.19 does not correctly configure logrotate, allowing a loca…
-
Unscored —
In FreeRADIUS 3.0 through 3.0.19, on average 1 in every 2048 EAP-pwd handshakes fails because the password element cann…
-
Unscored —
In FreeRADIUS 3.0.x before 3.0.20, the EAP-pwd module used a global OpenSSL BN_CTX instance to handle all handshakes. T…